Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

People who like this

1 Answer

a) you've edited the view on disk, but forgotten to hit the refresh endpoint to tell Splunkd to reload it from disk? (Use The FreshMaker in Sideview Utils - there's a link under "Key techniques > Tools")

b) Or that there's a version of the view in /local that's overriding the version in default? wherein it's still specifying $report$ instead of $report1$? If anyone ever edited the view through manager it will have created a second copy in local which completely overrides the one in default. Go to manager and view the source of the view and that will always be the one loaded in memory, no matter what directory it was loaded from.

If the arg.* names in the Redirector are matching the querystring arguments in the target page's URL, and the target page has a URLLoader module, and downstream from that URLLoader module there are $foo$ tokens that match those arguments in the URL, that's all you need.

To go further and prepopulate TextField and Pulldown and Checkbox modules from the URL, all you need is to have the "name" param on those modules also match the arguments in the URL.